es_inject

CVE-2014-3120 Elastic Search Remote Code Execution This project demonstrates the CVE-2014-3120 vulnerability/misconfiguration. It allows you to read from and append to files on the system hosting ES, provided the user running ES has access to them. Notes This does not require a web server. Save i...

CVE-2014-3120

CVE-2014-3120...

ElasticSearch-CVE-2014-3120

ElasticSearch search Remote Code Execution CVE-2014-3120 POC Code to exploit CVE-2014-3120 Requirements: python Usage: python elasticcheck.py Example: ➜ $ python elasticcheck.py hostport.txt 0 10.0.0.10:9200 Vulnerable 1 10.0.0.11:9201 Not Vulnerable 2 10.0.0.12:9201 Connection error Vulnerable...

com.github.tlrx:elasticsearch-test (0.90.6), com.sksamuel.elastic4s:elastic4s_2.10 (0.90.6.0) +9 more potentially affected by CVE-2014-3120 via org.elasticsearch:elasticsearch (0.90.6)

org.elasticsearch:elasticsearch MAVEN version 0.90.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.github.tlrx:elasticsearch-test 0.90.6 - com.sksamuel.elastic4s:elastic4s2.10 0.90.6.0 -...

com.github.kzwang:elasticsearch-osem (1.0.0), com.github.kzwang:elasticsearch-transport-redis (1.0.0) +13 more potentially affected by CVE-2014-3120 via org.elasticsearch:elasticsearch (0.90.10)

org.elasticsearch:elasticsearch MAVEN version 0.90.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.github.kzwang:elasticsearch-osem 1.0.0 - com.github.kzwang:elasticsearch-transport-redis...

at.molindo:esi4j (>=0.3.0, <=0.3.2), com.code972:elasticsearch-analysis-hebrew (1.0) +13 more potentially affected by CVE-2014-3120 via org.elasticsearch:elasticsearch (0.90.11)

org.elasticsearch:elasticsearch MAVEN version 0.90.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - at.molindo:esi4j =0.3.0, =0.3.2 - com.code972:elasticsearch-analysis-hebrew 1.0 -...

be.thematchbox:abstractriver (1.0.1), ch.epfl.bbp.nlp:bluima_elasticsearch (>=1.0.0, <=1.0.1) +227 more potentially affected by CVE-2014-3120 via org.elasticsearch:elasticsearch (>=1.0.0.beta1, <=1.3.9)

org.elasticsearch:elasticsearch MAVEN version =1.0.0.beta1, =1.0.0, =0.1pre4, =0.1pre4, =0.1pre4, =0.1pre4, =0.1.0, =1.2, =1.0.0, =1.1.2, =1.2, =2.3.0, =2.3.1 and more Source cves: CVE-2014-3120 Source advisory: GHSA-MRFM-JXGF-2H6V...

com.yakaz.elasticsearch.plugins:elasticsearch-action-reloadsettings (>=1.0.0, <=1.0.1) potentially affected by CVE-2014-3120 via org.elasticsearch:elasticsearch (0.90.0.rc1)

org.elasticsearch:elasticsearch MAVEN version 0.90.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.yakaz.elasticsearch.plugins:elasticsearch-action-reloadsettings =1.0.0, =1.0.1 Source...

org.elasticsearch:elasticsearch-analysis-icu (0.18.4), org.elasticsearch:elasticsearch-cloud-aws (0.18.4) +11 more potentially affected by CVE-2014-3120 via org.elasticsearch:elasticsearch (0.18.4)

org.elasticsearch:elasticsearch MAVEN version 0.18.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-analysis-icu 0.18.4 - org.elasticsearch:elasticsearch-cloud-aws...

org.dspace.modules:additions (>=3.0-rc2, <=3.6), org.dspace.modules:jspui (>=3.0-rc1, <=3.6) +27 more potentially affected by CVE-2014-3120 via org.elasticsearch:elasticsearch (0.18.6)

org.elasticsearch:elasticsearch MAVEN version 0.18.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.dspace.modules:additions =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc...

org.elasticsearch:elasticsearch-analysis-icu (0.15.1), org.elasticsearch:elasticsearch-cloud-aws (0.15.1) +11 more potentially affected by CVE-2014-3120 via org.elasticsearch:elasticsearch (0.15.1)

org.elasticsearch:elasticsearch MAVEN version 0.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-analysis-icu 0.15.1 - org.elasticsearch:elasticsearch-cloud-aws...

org.elasticsearch:elasticsearch-analysis-icu (0.16.5), org.elasticsearch:elasticsearch-cloud-aws (0.16.5) +11 more potentially affected by CVE-2014-3120 via org.elasticsearch:elasticsearch (0.16.5)

org.elasticsearch:elasticsearch MAVEN version 0.16.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-analysis-icu 0.16.5 - org.elasticsearch:elasticsearch-cloud-aws...

com.aconex.scrutineer:scrutineer (1.0.5), org.graylog2:graylog2-plugin (>=0.10.1, <=0.10.14) potentially affected by CVE-2014-3120 via org.elasticsearch:elasticsearch (0.19.10)

org.elasticsearch:elasticsearch MAVEN version 0.19.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.aconex.scrutineer:scrutineer 1.0.5 - org.graylog2:graylog2-plugin =0.10.1, =0.10.14 Source...

de.spinscale:elasticsearch-plugin-suggest (0.19.12-0.2) potentially affected by CVE-2014-3120 via org.elasticsearch:elasticsearch (0.19.12)

org.elasticsearch:elasticsearch MAVEN version 0.19.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - de.spinscale:elasticsearch-plugin-suggest 0.19.12-0.2 Source cves: CVE-2014-3120 Source advisor...

org.elasticsearch:elasticsearch-analysis-icu (0.16.3), org.elasticsearch:elasticsearch-cloud-aws (0.16.3) +11 more potentially affected by CVE-2014-3120 via org.elasticsearch:elasticsearch (0.16.3)

org.elasticsearch:elasticsearch MAVEN version 0.16.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-analysis-icu 0.16.3 - org.elasticsearch:elasticsearch-cloud-aws...

com.github.richardwilly98.elasticsearch:elasticsearch-river-mongodb (1.6.5), fr.pilato.spring:spring-elasticsearch (0.1.0) +1 more potentially affected by CVE-2014-3120 via org.elasticsearch:elasticsearch (0.20.6)

org.elasticsearch:elasticsearch MAVEN version 0.20.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.github.richardwilly98.elasticsearch:elasticsearch-river-mongodb 1.6.5 -...

com.github.tlrx:elasticsearch-test (0.0.8), com.yakaz.elasticsearch.plugins:elasticsearch-action-updatebyquery (1.1.0) +19 more potentially affected by CVE-2014-3120 via org.elasticsearch:elasticsearch (0.90.0.beta1)

org.elasticsearch:elasticsearch MAVEN version 0.90.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.github.tlrx:elasticsearch-test 0.0.8 -...

com.clever-age:play2-elasticsearch (0.8.1), com.github.richardwilly98.elasticsearch:elasticsearch-river-mongodb (>=1.7.1, <=1.7.2) +18 more potentially affected by CVE-2014-3120 via org.elasticsearch:elasticsearch (0.90.5)

org.elasticsearch:elasticsearch MAVEN version 0.90.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.clever-age:play2-elasticsearch 0.8.1 -...

at.molindo:esi4j (>=0.3.0-alpha-1, <=0.3.0-alpha-3), com.blacklocus.jres:jres-test (>=0.1.13, <=0.1.14) +17 more potentially affected by CVE-2014-3120 via org.elasticsearch:elasticsearch (0.90.7)

org.elasticsearch:elasticsearch MAVEN version 0.90.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - at.molindo:esi4j =0.3.0-alpha-1, =0.1.13, =0.1.1, =0.5.0, =0.2.0, =0.90.7.1, =0.8.1-0907,...

org.elasticsearch:elasticsearch-analysis-icu (0.17.8), org.elasticsearch:elasticsearch-cloud-aws (0.17.8) +11 more potentially affected by CVE-2014-3120 via org.elasticsearch:elasticsearch (0.17.8)

org.elasticsearch:elasticsearch MAVEN version 0.17.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-analysis-icu 0.17.8 - org.elasticsearch:elasticsearch-cloud-aws...